CVE-2024-50177 is a vulnerability identified in the Linux kernel, specifically within the AMD GPU driver component (amdgpu) related to the Direct Rendering Manager (DRM) subsystem. The issue arises in the display management logic, particularly in the DML2.1 (Display Mode Library) calculations. The vulnerability is caused by an unchecked calculation involving the cursor_width parameter, which is explicitly set to zero when programming a phantom pipe. This leads to an arithmetic overflow in an unsigned integer shift operation, triggering the kernel's Undefined Behavior Sanitizer (UBSAN) check. The overflow occurs because the shift exponent becomes excessively large (4294967170), which is invalid for a 32-bit unsigned integer type. This results in a kernel warning and potential instability or crash of the affected system. The root cause is a missing guard condition to verify cursor_width before performing size calculations in the amdgpu driver's display pipeline code. The vulnerability was fixed by adding a guard to prevent the overflow condition. The issue affects Linux kernel versions including the commit 70839da6360500a82e4d5f78499284474cbed7c1 and is present in kernel version 6.5.0-41-generic as per the example log. No known exploits are reported in the wild at this time, and no CVSS score has been assigned yet. The vulnerability primarily impacts systems running Linux with AMD GPUs using the affected amdgpu driver, potentially causing kernel crashes or denial of service due to the UBSAN-triggered fault during display mode programming.

For European organizations, this vulnerability could lead to system instability or denial of service on Linux-based systems equipped with AMD GPUs, particularly those using the affected kernel versions. This may affect workstations, servers, or embedded devices relying on AMD graphics hardware for display output. The impact is mainly on availability, as the kernel UBSAN warning indicates a runtime fault that could cause kernel panics or crashes, disrupting business operations. Confidentiality and integrity impacts are less likely since the vulnerability is a logic error causing overflow rather than a direct code execution or privilege escalation flaw. However, any disruption in critical systems, such as those used in industrial control, media production, or scientific computing, could have operational consequences. European organizations with large deployments of Linux systems running AMD GPUs, especially those using Ubuntu 22.04 LTS or similar distributions with kernel 6.5 or later, are at risk. The lack of known exploits reduces immediate threat but patching is recommended to prevent potential future exploitation or accidental system crashes.

1. Apply the latest Linux kernel updates that include the fix for CVE-2024-50177 as soon as they become available from your distribution vendor. For Ubuntu users, monitor and install kernel updates for versions 6.5.0-41-generic or later that address this issue. 2. For environments where immediate patching is not possible, consider temporarily disabling or avoiding workloads that heavily utilize AMD GPU display features or phantom pipe programming to reduce exposure. 3. Monitor system logs for UBSAN warnings or kernel messages related to amdgpu and drm subsystems to detect any attempts to trigger this vulnerability. 4. Engage with hardware and software vendors to confirm compatibility and support for patched kernels, ensuring that AMD GPU drivers are up to date. 5. Implement robust system monitoring and automated reboot or failover mechanisms to minimize downtime if kernel crashes occur. 6. For critical systems, consider testing kernel updates in staging environments to validate stability before production deployment.